Vulnerability · Published Jun 2, 2026 · Assigned by ProgressSoftware
CVE-2026-7195CWE-20: Improper Input Validation in web services in Progress Sitefinity
High 8.8
In plain English
A high-severity improper input validation in Sitefinity from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Sitefinity | 14.1.0 – before 14.4.014.4.8100 – before 14.4.815215.0.8200 – before 15.0.823415.1.8300 – before 15.1.833515.2.8400 – before 15.2.844115.3.8500 – before 15.3.853115.4.8600 – before 15.4.8630 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H